[PATCH] fs/ntfs3: fix KMSAN uninit-value in ni_create_attr_list

[PATCH] fs/ntfs3: fix KMSAN uninit-value in ni_create_attr_list

[Nirbhay Sharma]

The call to kmalloc() to allocate the attribute list buffer is given a
size of al_aligned(rs). This size can be larger than the data
subsequently copied into the buffer, leaving trailing bytes uninitialized.

This can trigger a KMSAN "uninit-value" warning if that memory is
later accessed.

Fix this by using kzalloc() instead, which ensures the entire
allocated buffer is zero-initialized, preventing the warning.

Reported-by: syzbot+83c9dd5c0dcf6184fdbf@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=83c9dd5c0dcf6184fdbf
Signed-off-by: Nirbhay Sharma <nirbhay.lkd@gmail.com>
---
The following syzbot test commands were used to verify the fix against
both linux-next and a specific mainline commit. Both kernels were
configured with CONFIG_KMSAN=y, and no KMSAN warnings were observed
with the patch applied.

An attempt to test against the latest mainline tip failed due to an
unrelated boot failure in the SCSI subsystem (KMSAN: use-after-free in
scsi_get_vpd_buf). Therefore, testing was done on the last known-good
mainline commit below.

For mainline commit 9b0d551bcc05 ("Merge tag 'pull-misc' of..."):
#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 9b0d551bcc05

For the linux-next branch:
#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master

 fs/ntfs3/frecord.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/ntfs3/frecord.c b/fs/ntfs3/frecord.c
index 8f9fe1d7a690..4fe8da7fc034 100644
--- a/fs/ntfs3/frecord.c
+++ b/fs/ntfs3/frecord.c
@@ -767,7 +767,7 @@ int ni_create_attr_list(struct ntfs_inode *ni)
 	 * Skip estimating exact memory requirement.
 	 * Looks like one record_size is always enough.
 	 */
-	le = kmalloc(al_aligned(rs), GFP_NOFS);
+	le = kzalloc(al_aligned(rs), GFP_NOFS);
 	if (!le)
 		return -ENOMEM;
 
-- 
2.51.0

Re: [syzbot] [ntfs3?] KMSAN: uninit-value in attr_set_size

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+83c9dd5c0dcf6184fdbf@syzkaller.appspotmail.com
Tested-by: syzbot+83c9dd5c0dcf6184fdbf@syzkaller.appspotmail.com

Tested on:

commit:         9b0d551b Merge tag 'pull-misc' of git://git.kernel.org..
git tree:       https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=17a855cd980000
kernel config:  https://syzkaller.appspot.com/x/.config?x=50fb29d81ff5a3df
dashboard link: https://syzkaller.appspot.com/bug?extid=83c9dd5c0dcf6184fdbf
compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
patch:          https://syzkaller.appspot.com/x/patch.diff?x=1609f942580000

Note: testing is done by a robot and is best-effort only.

Re: [PATCH] fs/ntfs3: fix KMSAN uninit-value in ni_create_attr_list

[Nirbhay Sharma]

On 10/7/25 4:08 AM, Nirbhay Sharma wrote:
> The call to kmalloc() to allocate the attribute list buffer is given a
> size of al_aligned(rs). This size can be larger than the data
> subsequently copied into the buffer, leaving trailing bytes uninitialized.
> 
> This can trigger a KMSAN "uninit-value" warning if that memory is
> later accessed.
> 
> Fix this by using kzalloc() instead, which ensures the entire
> allocated buffer is zero-initialized, preventing the warning.
> 
> Reported-by: syzbot+83c9dd5c0dcf6184fdbf@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=83c9dd5c0dcf6184fdbf
> Signed-off-by: Nirbhay Sharma <nirbhay.lkd@gmail.com>
> ---
> The following syzbot test commands were used to verify the fix against
> both linux-next and a specific mainline commit. Both kernels were
> configured with CONFIG_KMSAN=y, and no KMSAN warnings were observed
> with the patch applied.
> 
> An attempt to test against the latest mainline tip failed due to an
> unrelated boot failure in the SCSI subsystem (KMSAN: use-after-free in
> scsi_get_vpd_buf). Therefore, testing was done on the last known-good
> mainline commit below.
> 
> For mainline commit 9b0d551bcc05 ("Merge tag 'pull-misc' of..."):
> #syz test: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 9b0d551bcc05
> 
> For the linux-next branch:
> #syz test: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master
> 
>   fs/ntfs3/frecord.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/fs/ntfs3/frecord.c b/fs/ntfs3/frecord.c
> index 8f9fe1d7a690..4fe8da7fc034 100644
> --- a/fs/ntfs3/frecord.c
> +++ b/fs/ntfs3/frecord.c
> @@ -767,7 +767,7 @@ int ni_create_attr_list(struct ntfs_inode *ni)
>   	 * Skip estimating exact memory requirement.
>   	 * Looks like one record_size is always enough.
>   	 */
> -	le = kmalloc(al_aligned(rs), GFP_NOFS);
> +	le = kzalloc(al_aligned(rs), GFP_NOFS);
>   	if (!le)
>   		return -ENOMEM;
>   
Hi Konstantin,

I sent this patch about 3 weeks ago and haven't heard back yet. I wanted
to check if there are any concerns with the patch or if any changes are
needed. The fix addresses a KMSAN uninit-value bug and has been tested
successfully on both linux-next and the commit from the syzbot report.

Please let me know if you need any additional information or testing.

Thanks,
Nirbhay

Re: [PATCH] fs/ntfs3: fix KMSAN uninit-value in ni_create_attr_list

[Konstantin Komarov]

On 10/25/25 17:07, Nirbhay Sharma wrote:
>
>
> On 10/7/25 4:08 AM, Nirbhay Sharma wrote:
>> The call to kmalloc() to allocate the attribute list buffer is given a
>> size of al_aligned(rs). This size can be larger than the data
>> subsequently copied into the buffer, leaving trailing bytes 
>> uninitialized.
>>
>> This can trigger a KMSAN "uninit-value" warning if that memory is
>> later accessed.
>>
>> Fix this by using kzalloc() instead, which ensures the entire
>> allocated buffer is zero-initialized, preventing the warning.
>>
>> Reported-by: syzbot+83c9dd5c0dcf6184fdbf@syzkaller.appspotmail.com
>> Closes: https://syzkaller.appspot.com/bug?extid=83c9dd5c0dcf6184fdbf
>> Signed-off-by: Nirbhay Sharma <nirbhay.lkd@gmail.com>
>> ---
>> The following syzbot test commands were used to verify the fix against
>> both linux-next and a specific mainline commit. Both kernels were
>> configured with CONFIG_KMSAN=y, and no KMSAN warnings were observed
>> with the patch applied.
>>
>> An attempt to test against the latest mainline tip failed due to an
>> unrelated boot failure in the SCSI subsystem (KMSAN: use-after-free in
>> scsi_get_vpd_buf). Therefore, testing was done on the last known-good
>> mainline commit below.
>>
>> For mainline commit 9b0d551bcc05 ("Merge tag 'pull-misc' of..."):
>> #syz test: 
>> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 
>> 9b0d551bcc05
>>
>> For the linux-next branch:
>> #syz test: 
>> https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git 
>> master
>>
>>   fs/ntfs3/frecord.c | 2 +-
>>   1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/fs/ntfs3/frecord.c b/fs/ntfs3/frecord.c
>> index 8f9fe1d7a690..4fe8da7fc034 100644
>> --- a/fs/ntfs3/frecord.c
>> +++ b/fs/ntfs3/frecord.c
>> @@ -767,7 +767,7 @@ int ni_create_attr_list(struct ntfs_inode *ni)
>>        * Skip estimating exact memory requirement.
>>        * Looks like one record_size is always enough.
>>        */
>> -    le = kmalloc(al_aligned(rs), GFP_NOFS);
>> +    le = kzalloc(al_aligned(rs), GFP_NOFS);
>>       if (!le)
>>           return -ENOMEM;
> Hi Konstantin,
>
> I sent this patch about 3 weeks ago and haven't heard back yet. I wanted
> to check if there are any concerns with the patch or if any changes are
> needed. The fix addresses a KMSAN uninit-value bug and has been tested
> successfully on both linux-next and the commit from the syzbot report.
>
> Please let me know if you need any additional information or testing.
>
> Thanks,
> Nirbhay

Hello,

Your patch has been applied, but it hasn’t been pushed to our repository
yet. It will be there as soon as possible.

I’ll let you know once it’s merged into kernel. Thanks for your patience.

Regards,
Konstantin